Separation of Duty

Security Patterns

Meaning

Separation of Duty is a security principle that divides critical tasks among multiple roles to prevent fraud or error. It addresses the risk that a single individual could abuse authority by performing all steps of a sensitive process. The principle is applied whenever a workflow involves high‑value transactions, privileged operations, or compliance‑driven activities.

Primary Function

Access control

Communicative Purpose

Prevents a single actor from completing a critical transaction alone

Pattern

Define role → assign duties → enforce separation checks

Função primária

Access control

Propósito comunicativo

Prevents a single actor from completing a critical transaction alone

Situações de gatilho

Financial systems: approving large fund transfers; IT operations: deploying production changes; Healthcare: accessing patient records for both entry and audit

Contextos

Enterprise applications, banking software, ERP systems, compliance‑focused services, cloud IAM platforms

Padrão

Define role → assign duties → enforce separation checks

Colocados típicos

role
permission
audit log
policy engine

Substituições comuns

Using a single admin role instead of distinct duties → increases risk of privilege abuse
Merging approval and execution steps → defeats the purpose of separation

Erros comuns

Assigning both approval and execution permissions to the same role, leading to unchecked actions Implementing checks only at the UI layer, which can be bypassed by API calls Forgetting to audit role changes, allowing privilege escalation after initial separation

Similar / contraste

Least Privilege: limits permissions per role, while Separation of Duty splits responsibilities across roles Defense in Depth: adds multiple security layers, whereas Separation of Duty focuses on role distribution

Interferências

Coming from JavaScript: assuming function‑level checks are sufficient → need system‑wide policy enforcement in backend services

Família do chunk

Principle of Least Privilege
Defense in Depth
Role‑Based Access Control

Nuance

1) Do not apply when a single user legitimately performs all steps in a low‑risk context; 2) Additional role checks introduce minimal performance overhead, typically a few microseconds per request; 3) Ensure that role hierarchies do not inadvertently collapse distinct duties into a single authority

Efeito pragmático

Reduces the likelihood of insider fraud and accidental errors by requiring multiple independent actors to complete sensitive operations

Dica de memória

Think of a bank vault that requires two different keys held by separate officers to open, ensuring no single person can unlock it alone.

Nota

Often enforced via workflow engines, RBAC systems, or dedicated policy‑as‑code frameworks

Upgrade path

Adopt Role‑Based Access Control (RBAC) with fine‑grained policies and automated audit trails

Frequência: MediumFormulaicidade: FlexibleTipo de construção: conceptPrioridade de aquisição: Active recallPrioridade de output: InputTag de espaçamento: Medium-term

Examples

def approve_transfer(user, amount): if not has_role(user, 'approver'): raise PermissionError('User lacks approver role') # record approval audit_log(user, 'approved', amount) def execute_transfer(user, amount): if not has_role(user, 'executor'): raise PermissionError('User lacks executor role') # perform the transfer process_payment(amount) # Usage approve_transfer(alice, 10000) # Alice must have 'approver' role execute_transfer(bob, 10000) # Bob must have 'executor' role

from functools import wraps def requires_separation(duty): def decorator(func): @wraps(func) def wrapper(user, *args, **kwargs): if duty not in get_user_duties(user): raise PermissionError(f'User lacks {duty} duty') return func(user, *args, **kwargs) return wrapper return decorator @requires_separation('reviewer') def review_document(user, doc_id): print(f'{user} reviewed document {doc_id}') @requires_separation('publisher') def publish_document(user, doc_id): print(f'{user} published document {doc_id}') # In a workflow, reviewer and publisher are distinct users

# Using a policy engine (e.g., OPA) to enforce separation of duty policy = ''' package authz separation_of_duty[allowed] { input.action == "transfer" allowed := input.user.role == "approver" and input.context.approved == true } ''' # The application evaluates the policy before executing a transfer if evaluate_policy(policy, request): execute_transfer(request.user, request.amount) else: raise PermissionError('Separation of duty check failed')